##osx-server

i was close!!

At least it's not the old pre-OS X epoch of 1904 :D

frogor: How about the date that files temporarily have during a file copy

A Finder file copy

foigus: Is it the Cocoa one in the list? 2001?

I've never noticed.

And now I'm curious :p

Oh, should I hold back spoiling it

frogor: i think i may have a new game with colleagues phones

(well iPads would be better)

frogor: In case you don't see it https://community.emc.com/message/774946#774946

The date Jobs took to the stage to show off the very first Macintosh in a live demonstration

Cuuute.

It's apparently used as a magic timestamp for several things.

Mac App Store incomplete/in-progress downloads have it as the data modified date

*date

Man, that better be one of the trivia questions this year at MacTech.

Similar to how the Quicktime video capture in 10.10 of an attached iOS device always shows full wifi signal, no carrier ID, full battery charge - and the infamous 9:41 AM time

heh

(the time of day when Jobs unveiled the iPhone)

frogor: That's hard to beleive

I was there; pretty sure the keynote didn't start until 10a,

But my memory could be wrong

Obviously my memory is wrong: http://appleinsider.com/articles/06/10/03/steve...

But I do remember my helicopter was forced to land after being damaged by a surface-to-air missile.

:D

Oooh, and did you chase llamas today

anyone else's Airwatch busted for enrolments?

screw it... night all

SUCCESS

Phase 1 of client ssl certs with Chef complete

Now phase 2 is to undo all of the terrible design decisions made by the original author of this cookbook

Nick_ZWG: Why have you taken this upon yourself?

A) To prove that it works and I can do it B) It will probably make the Facebookers happy and C) it's a good way to forcefully learn Ruby

Primarily, the goal is to see if I can do a secure bootstrap of a machine, from out of box, with a secure SSL client cert connection to the munki server, using Chef

I already did it with Puppet

Right, so why do it again with Chef?

Because tbh I don't think I'm going to end up using puppet

Bored?

Because he doesn't climb moutains physically, only metaphorically.

*mountains

Ehhh, I wouldn't say boredom so much as experimentation

And it might benefit someone

Nick_ZWG: What's the appeal of chef over puppet for you? What does it do differently that you like more?

frogor: Doesn't require a big honking server to do all the hard work

If I was going to use puppet, it'd have to be masterless, I think

but if I used masterless puppet, that removes part of the value of having it set up client certs

Ah. So without a server centric design, chef is still using client certs / able to issue them?

Or is this something you created for chef that it didn't have before?

frogor: Little of both. Chef doesn't use client certs by itself.

But there's a cookbook for creating a CA, and it can be used to generate certs on nodes

Simple cert storage / generation has very little resource use, so it's easy to handle.

The problem is that the x509 cookbook for Chef is dumb and has been abandoned by the author

And since I happen to not have any huge projects on my plate right now, fixing x509 for chef seems like a fun thing to do

This one? https://github.com/VendaTech/chef-cookbook-ssl

Yep.

Here's my fixed version: https://github.com/nmcspadden/chef-cookbook-ssl...

(still in progress)

The main problem with the original is that it doesn't work on OS X out of the box

Nick_ZWG: Before or after OS X went to ruby 2.0 by default? ;)

That's not the problem. The problem is that the recipe explicitly tries to create a file owned by 'root' with group 'root'

'root' group no workey OS X

it also doesn't work if you pass it a certificate path that doesn't exist on the file system, it won't create it for you

So there were a number of things that had to be fixed

Interesting. So is there a mini web-service involved for the CA so that it auto-responses to CSRs ?

No, it doesn't.

That's the biggest problem.

It requires manual intervention.

Someone on the server has to run chef-ssl sign <whatever> or chef-ssl autosign <whatever>

Fixing that is a much larger project, down the line

I can work around it for the moment

Well, I mean when you go (mostly) server-less, that becomes the problem with PKI: how do you verify a request for a client cert is legit? From whom does the authority/legitimacy descend?

I guess you could do a shared password. Or some sort of challenge response mechanism.

So the clients have the password but never send it over the clear / even during a HTTPS session.

Pretty easy to code that kinda thing.

Nick_ZWG: Next thing you know you'll be designing an API and web service ;D

Right. This was relatively easy with Puppet, because Puppet a) uses client certs out of the box and b) has a mechanism for policy-based signing

Which I was able to leverage very effectively.

This might be a bit of a fool's errand, but I want to recreate that behavior in Chef

Nick_ZWG: The results of a google search for: chef csr ca are not encouraging :) Unless you're excited about the prospect of blazing a new trail.

Blazing new trails is fun!

Hey now, that's my motto.

:D

It is fun though.

"Why did you implement a Munki-themed PKI setup in Chef?" "Because nobody else did!"

Seriously, though.

I'm totally getting into devops

Good. That's where all the fun is.

Sometimes I think people look at you though like you're the person bouncing up and down to go on the rollercoaster while they're sucking down Dramamine / motion sickness pills like they're going out of style.

good find by @foigus: Syntax highlighting of pkginfo files in TextWranglerhttps://osxbytes.wordpress.com/2015...

better link: https://osxbytes.wordpress.com/2015/02/26/synta...

Yeah, that's eholtam_'s blog

Very nice!

just job eholtam_

just awesome job eholtam_

typing degenerating late in the day...

elliotjordan: You should fire your typist, hire a new one.

Never seem to find a good one.

Saved!

That's a good find, thanks